ca59a8044c256586ebdb419e58113e4098460a3619fc863de8381045b425083f

Analysis

max time kernel
131s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe
Size

49KB
MD5

3435b13de3832d85b630578c45876454
SHA1

c9f95b1ff9850a8f00bff008814ac1496d0ce8ca
SHA256

ca59a8044c256586ebdb419e58113e4098460a3619fc863de8381045b425083f
SHA512

6c8142eb79edb7429b33fc8e02da6a299d85c1539af6134eb7345f3c6d1c9006834294b6f3f1e74bcbc54864a6861f7547a0649c353ba369e4010bbcec146dfc
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvgpnuQ3SzjRf:6j+1NMOtEvwDpjr8hgpuQ34

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000012238-11.dat	CryptoLocker_rule2
behavioral1/memory/1720-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1344-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a000000012238-11.dat	CryptoLocker_set1
behavioral1/memory/1720-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1344-25-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000a000000012238-11.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1720-15-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1344-25-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Executes dropped EXE 1 IoCs

pid	Process
1344	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1720	2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1344	1720	2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe	28
PID 1720 wrote to memory of 1344	1720	2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe	28
PID 1720 wrote to memory of 1344	1720	2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe	28
PID 1720 wrote to memory of 1344	1720	2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
49KB

MD5
947c8daaab00c33cf088a3a20a62b108

SHA1
d77473cbdae2fd3f68f4a774b97577d3977ec3c9

SHA256
aee4e06faaffe0df451f46bcaca4b0d719652253947868c7872cf9c524351c08

SHA512
23f3b78dd3750337a103204d2dc953d688ea68d8b7c54fe86655040fc3f5a305a849f485e6fb32d0f00f6b7144a3e2ff53bd439b636149af9a3bf178012c2783

Download Submit
memory/1344-18-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1344-17-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1344-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1720-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1720-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1720-3-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1720-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1720-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download